Many recent works have focused on adversarial detection, trying to distinguish adversarial from natural images. In [1]} Hendrycks & Gimpel show that adversarial examples have higher weights for larger principal components of the images' decomposition and use this finding to train a detector. Both Li et al. [2]} and Bhagoji et al. [3]} leverage PCA as well, one by looking at the values after the inner convolutional layers the other to reduce their dimensionality. Based on the responses of the neural networks' final layer Feinman et al. [4]} define two metrics, the kernel density estimation and the Bayesian neural network uncertainty to identify adversarial perturbation.
Liu et al. [5]} proposed a method to detect adversarial examples by leveraging steganalysis and estimating the probability of modifications caused by adversarial attacks. Grosse et al. [6]} used the statistical test of maximum mean discrepancy to detect adversarial samples. Using the correlation between helpful images based on influence functions and the k-nearest neighbors in the embedding space of the DNN, Cohen et al. [7]} proposed an adversarial detector.
Besides the statistical analysis of the input images, adding a second neural network to decide whether an image is an adversarial example is another possibility. Metzen et al. [8]} proposed a model that is trained on outputs of multiple intermediate layers. As Carlini & Wagner state [9]}, the problem of a second neural network is that it can be easily circumvented by a so-called secondary attack.
Two strong and popular detectors are the Local Intrinsic Dimensionality (LID)[10]} and the Mahalanobis Distance (M-D)[11]} detectors. Ma et al. used the Local Intrinsic Dimensionality as a characteristic of adversarial subspaces and identified attacks using this measure. Lee et al. computed the empirical mean and covariance for each training sample and then calculated the Mahalanobis distance between a test sample and its nearest class-conditional Gaussians.
